PanIAM Cloud
A Luxembourg startup offering an agentless, EU-hosted CNAPP that maps cloud attack paths and ranks fixes by risk reduction.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
PanIAM Cloud is a Luxembourg-based cloud-native application protection platform (CNAPP) that builds a graph of every identity, resource, and permission in a customer’s cloud environment to surface the attack paths an adversary could actually walk. Rather than flagging every misconfiguration equally, it ranks remediations by how much risk they remove versus how much effort they take, and it extends visibility to how AI agents connect to users, databases, servers, and other agents inside the environment. The product is agentless, deploying without installing software on monitored systems.
Founded in 2025 and based in Esch-sur-Alzette, the company is led by CEO Gilles Katz, Chief Science Officer Jean-Yves Pasquier, and CTO Arthur Weber. It markets itself as “proudly European,” building, hosting, and operating entirely within the EU, and frames its compliance reporting around DORA, NIS2, and the Cyber Resilience Act. PanIAM won the cybersecurity innovation prize at Luxembourg Cybersecurity Week 2025 and is receiving support from the Lucya accelerator and Wavestone.
At three employees and without a disclosed funding round beyond accelerator backing, PanIAM is very early stage. Its EU-sovereign hosting and compliance framing is a genuine differentiator for regulated European customers wary of US-hosted CNAPP vendors, but the company has no customer case studies or independent test results yet.
Innovation Matrix Assessment
Within its first year the company shipped an agentless attack-path graph covering identities, resources, and AI-agent connections, and won a regional innovation award, indicating fast early execution.
Ranking remediations by actual risk reduction versus effort helps a stretched cloud security team prioritize instead of drowning in an undifferentiated misconfiguration backlog.
Momentum is limited to a Luxembourg Cybersecurity Week 2025 award and accelerator backing (Lucya, Wavestone); no VC round, named customer, or analyst coverage was found.
Agentless deployment and EU-sovereign hosting aimed at DORA/NIS2/CRA compliance differentiate it for European regulated customers, though attack-path graphing itself is not new (SpecterOps, Wiz, and others already do it).
No customer case study or independent benchmark was found; evidence of real-world detection accuracy rests entirely on the vendor's own site.
EU regulatory pressure (DORA, NIS2, CRA) and data-sovereignty concerns give the positioning a relevant, durable hook for European buyers specifically.
Why CISOs Should Care
A CISO at a DORA- or NIS2-regulated European firm gets cloud attack-path visibility and prioritized remediation guidance from a vendor whose hosting and operations stay entirely within the EU.
What Makes It Different
It combines agentless attack-path mapping with EU-sovereign hosting and compliance reporting purpose-built for European regulation, rather than a US-hosted CNAPP retrofitted with a compliance module.
The Matrix Verdict
45/100 — EMERGING / UNRANKED
PanIAM lands in the Emerging/Unranked tier: a three-person, accelerator-stage startup with a sensible EU-sovereignty angle on CNAPP but no funding round, customers, or independent validation yet.
Editorial Note: Claims vs. Verified Findings
Founding year, headcount, and funding status come from PitchBook and the Luxembourg business registry rather than independent press; the company's own claims about remediation accuracy and setup speed are unverified.
Sources
Alternatives to PanIAM Cloud
Wiz
Agentless, graph-based cloud security platform that maps multi-cloud risk end-to-end, now owned by Google after a record $32B…
Chainguard
Provides hardened, minimal, continuously-rebuilt container images and software packages to eliminate vulnerabilities before they reach production.
Second Front Systems
A Wilmington, DE defense-tech company whose Game Warden platform deploys commercial SaaS into DoD classified networks in 90…
Sysdig
The company behind Falco, the CNCF's runtime security standard, offering an eBPF/kernel-level CNAPP built on live syscall-based threat…
Microsoft Defender for Cloud
Microsoft's built-in cloud-native application protection platform, unifying CSPM, workload protection, and DevOps security natively across Azure, AWS, and…
Obsidian Security
Obsidian Security provides a SaaS security posture management (SSPM) platform that detects identity-centric threats and misconfigurations across enterprise…